# Known-vulnerable dependencies, via osv-scanner against the OSV database.
#
# Reads every lockfile and manifest it recognises (pnpm/npm/yarn, pip/uv/poetry,
# go.mod, NuGet, Cargo and more). Accepted vulnerabilities go in an
# osv-scanner.toml in the calling repo as [[IgnoredVulns]] entries with a
# reason and an ignoreUntil date, so an exception expires instead of
# silently living forever.
on:
  workflow_call:

jobs:
  osv-scanner:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: osv-scanner
        run: |
          osv-scanner --version | head -1
          rc=0
          osv-scanner scan source --recursive . || rc=$?
          # 128 means no lockfile or manifest was found: nothing to check, not a failure.
          if [ "$rc" -eq 128 ]; then
            echo "No supported lockfiles or manifests found; nothing to scan."
            exit 0
          fi
          exit "$rc"